From fa5b4979e8878bec97cd947fe3b8f4f747c7b5fb Mon Sep 17 00:00:00 2001 From: A <258483684+la14-1@users.noreply.github.com> Date: Fri, 13 Feb 2026 02:11:47 -0800 Subject: [PATCH] fix: upgrade SSH to StrictHostKeyChecking=accept-new (TOFU) and randomize temp paths (#849) - Change SSH default from StrictHostKeyChecking=no to accept-new, which accepts host keys on first connection but rejects if they change later (Trust On First Use). This protects against MITM attacks on subsequent connections. Requires OpenSSH 7.6+ (released Oct 2017). - Replace predictable $$-based temp file path in upload_config_file with $RANDOM to prevent symlink attacks on the remote server. Addresses findings from issue #763. Agent: security-auditor Co-authored-by: A <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) --- cli/src/__tests__/shared-common-logging-utils.test.ts | 4 ++-- shared/common.sh | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/cli/src/__tests__/shared-common-logging-utils.test.ts b/cli/src/__tests__/shared-common-logging-utils.test.ts index 6102c704..a51fc648 100644 --- a/cli/src/__tests__/shared-common-logging-utils.test.ts +++ b/cli/src/__tests__/shared-common-logging-utils.test.ts @@ -667,9 +667,9 @@ describe("SSH_OPTS defaults", () => { expect(result.stdout.length).toBeGreaterThan(0); }); - it("should disable strict host key checking", () => { + it("should use accept-new for strict host key checking (TOFU)", () => { const result = runBash('echo "$SSH_OPTS"'); - expect(result.stdout).toContain("StrictHostKeyChecking=no"); + expect(result.stdout).toContain("StrictHostKeyChecking=accept-new"); }); it("should use /dev/null for known hosts file", () => { diff --git a/shared/common.sh b/shared/common.sh index b602d945..923926d9 100644 --- a/shared/common.sh +++ b/shared/common.sh @@ -960,7 +960,7 @@ register_cleanup_trap() { # Default SSH options for all cloud providers # Clouds can override this if they need provider-specific settings if [[ -z "${SSH_OPTS:-}" ]]; then - SSH_OPTS="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -i ${HOME}/.ssh/id_ed25519" + SSH_OPTS="-o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -i ${HOME}/.ssh/id_ed25519" fi # ============================================================ @@ -1939,7 +1939,7 @@ upload_config_file() { printf '%s\n' "${content}" > "${temp_file}" - local temp_remote="/tmp/spawn_config_$$_$(basename "${remote_path}")" + local temp_remote="/tmp/spawn_config_${RANDOM}_${RANDOM}_$(basename "${remote_path}")" ${upload_callback} "${temp_file}" "${temp_remote}" ${run_callback} "mv ${temp_remote} ${remote_path}" }